In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.

The version of patch installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-13636 advisory.

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - patch: directory traversal via file rename (CVE-2015-1395)

  - GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.
    (CVE-2015-1196)

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:1852 advisory.

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-1852 advisory.

    - CVE-2019-13636 , Dont follow symlinks unless --follow-symlinks is given

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1932-1 advisory.

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1925-1 advisory.

  - A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. (CVE-2018-6952)

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2020:1852 advisory.

  - In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1852 advisory.

  - patch: the following of symlinks in inp.c and util.c is mishandled in cases other than input files     (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1852 advisory.

    The patch program applies diff files to originals. The diff command is used to compare an original to a     changed file. Diff lists the changes made to the file. A person who has the original file can then use the     patch command with the diff file to add the changes to their original file (patching the file).

    Security Fix(es):

    * patch: the following of symlinks in inp.c and util.c is mishandled in cases other than input files     (CVE-2019-13636)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the patch package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In GNU patch through 2.7.6, the following of symlinks     is mishandled in certain cases other than input files.
    This affects inp.c and util.c.(CVE-2019-13636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the patch package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In GNU patch through 2.7.6, the following of symlinks     is mishandled in certain cases other than input files.
    This affects inp.c and util.c.(CVE-2019-13636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of patch installed on the remote host is prior to 2.7.1-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1457 advisory.

    In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input     files. This affects inp.c and util.c. (CVE-2019-13636)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the patch package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In GNU patch through 2.7.6, the following of symlinks     is mishandled in certain cases other than input files.
    This affects inp.c and util.c.(CVE-2019-13636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the patch package has been released.

The remote host is affected by the vulnerability described in GLSA-201908-22 (Patch: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Patch. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could pass a specially crafted diff file to Patch,       possibly resulting in a Denial of Service condition or arbitrary code       execution.
  Workaround :

    There is no known workaround at this time.

Imre Rad discovered several vulnerabilities in GNU patch, leading to shell command injection or escape from the working directory and access and overwrite files, if specially crafted patch files are processed.

This update includes a bugfix for a regression introduced by the patch to address CVE-2018-1000156 when applying an ed-style patch (#933140).

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4071-1 advisory.

    It was discovered that Patch incorrectly handled certain files. An attacker could possibly use this issue     to access sensitive information. (CVE-2019-13636)

    It was discovered that Patch incorrectly handled certain files. An attacker could possibly use this issue     to execute arbitrary code. (CVE-2019-13638)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Handling of symlinks in patch, a tool to apply a diff file to an original, was wrong in certain cases.

For Debian 8 'Jessie', this problem has been fixed in version 2.7.5-1+deb8u2.

We recommend that you upgrade your patch packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
201634	CBL Mariner 2.0 Security Update: patch (CVE-2019-13636)	Nessus	MarinerOS Local Security Checks	medium
198348	RHEL 7 : patch (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196246	RHEL 5 : patch (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196239	RHEL 6 : patch (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
184516	Rocky Linux 8 : patch (RLSA-2020:1852)	Nessus	Rocky Linux Local Security Checks	medium
180982	Oracle Linux 8 : patch (ELSA-2020-1852)	Nessus	Oracle Linux Local Security Checks	medium
161833	SUSE SLES12 Security Update : patch (SUSE-SU-2022:1932-1)	Nessus	SuSE Local Security Checks	medium
161826	SUSE SLED15 / SLES15 Security Update : patch (SUSE-SU-2022:1925-1)	Nessus	SuSE Local Security Checks	medium
157681	AlmaLinux 8 : patch (ALSA-2020:1852)	Nessus	Alma Linux Local Security Checks	medium
145812	CentOS 8 : patch (CESA-2020:1852)	Nessus	CentOS Local Security Checks	medium
143013	RHEL 8 : patch (RHSA-2020:1852)	Nessus	Red Hat Local Security Checks	medium
142347	EulerOS 2.0 SP2 : patch (EulerOS-SA-2020-2378)	Nessus	Huawei Local Security Checks	medium
141749	EulerOS Virtualization 3.0.2.2 : patch (EulerOS-SA-2020-2220)	Nessus	Huawei Local Security Checks	medium
140887	EulerOS 2.0 SP3 : patch (EulerOS-SA-2020-2120)	Nessus	Huawei Local Security Checks	medium
138623	Amazon Linux 2 : patch (ALAS-2020-1457)	Nessus	Amazon Linux Local Security Checks	medium
137985	EulerOS Virtualization 3.0.6.0 : patch (EulerOS-SA-2020-1766)	Nessus	Huawei Local Security Checks	medium
136243	EulerOS Virtualization for ARM 64 3.0.2.0 : patch (EulerOS-SA-2020-1540)	Nessus	Huawei Local Security Checks	medium
135122	EulerOS Virtualization for ARM 64 3.0.6.0 : patch (EulerOS-SA-2020-1335)	Nessus	Huawei Local Security Checks	medium
134808	EulerOS 2.0 SP5 : patch (EulerOS-SA-2020-1317)	Nessus	Huawei Local Security Checks	medium
134005	EulerOS 2.0 SP8 : patch (EulerOS-SA-2020-1171)	Nessus	Huawei Local Security Checks	medium
128739	Photon OS 3.0: Patch PHSA-2019-3.0-0025	Nessus	PhotonOS Local Security Checks	high
128712	Photon OS 2.0: Patch PHSA-2019-2.0-0172	Nessus	PhotonOS Local Security Checks	high
127971	GLSA-201908-22 : Patch: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
127102	Debian DSA-4489-1 : patch - security update	Nessus	Debian Local Security Checks	high
127042	Ubuntu 16.04 LTS / 18.04 LTS : Patch vulnerabilities (USN-4071-1)	Nessus	Ubuntu Local Security Checks	high
126833	Debian DLA-1856-1 : patch security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-13636

medium

Tenable Plugins

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

medium